Description
The Tomcat 6 DIGEST authentication functionality as used in Red Hat Enterprise Linux 6 allows remote attackers to bypass intended access restrictions by performing a replay attack after a nonce becomes stale. NOTE: this issue is due to an incomplete fix for CVE-2012-5887.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | tomcat6 +8 | 6.0.24-55.el6_4 | RHSA-2013:0869 |
Advisories 1
- RHSA-2013:0869 Red Hat Security Advisory: tomcat6 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
References
- 60187 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=959047
- RHSA-2013:0869 vendor-advisory